[jira] [Commented] (HADOOP-10895) HTTP KerberosAuthenticator fallback should have a flag to disable it

[Yongjun Zhang (JIRA)]

    [ 
https://issues.apache.org/jira/browse/HADOOP-10895?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14194956#comment-14194956
 ] 

Yongjun Zhang commented on HADOOP-10895:
----------------------------------------

Thanks [~tucu00], 

Rev3's AuthenticatedURL code is already very much like what you said:
{code}
  /*
   *  whether it's allowed to let DEFAULT_AUTHENTICATOR to fallback to 
PseudoAuthenticator
   */
  private static boolean allowDefaultAuthToFallbackToPseudo = false;
  
  /**
   * Set to allow/disallow the DEFAULT_AUTHENTICATOR to fallback to
   * PseudoAuthenticator. Notice that by default, the DEFAULT_AUTHENTICATOR
   * disallow the fallback.
   */
  public static void setAllowDefaultAuthToFallbackToPseudo(
      final boolean allowFallback) {
    allowDefaultAuthToFallbackToPseudo = allowFallback;
  }

  public AuthenticatedURL(Authenticator authenticator,
                          ConnectionConfigurator connConfigurator) {
    try {
      if (authenticator != null) {
        this.authenticator = authenticator;
      } else {
        // use default authenticator
        this.authenticator = DEFAULT_AUTHENTICATOR.newInstance();   
        this.authenticator.setAllowFallbackToPseudoAuthenticator(              
<=== configure the authenticator
            allowDefaultAuthToFallbackToPseudo);
      }
    } catch (Exception ex) {
      throw new RuntimeException(ex);
    }
    ...
{code}
except it calls {{DEFAULT_AUTHENTICATOR.newInstance()}} to create an 
authenticator instance. So what you were suggesting is to replace this line 
with a {{getAuthenticator()}} call, that retrieves the static instance from the 
corresponding authenticator class (Per your earlier suggestion, each 
authenticator class is going to have a static instance member).  

Is my understanding correct? If so, a little change on top of rev3 would 
address your suggestions...

Thanks.


> HTTP KerberosAuthenticator fallback should have a flag to disable it
> --------------------------------------------------------------------
>
>                 Key: HADOOP-10895
>                 URL: https://issues.apache.org/jira/browse/HADOOP-10895
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 2.4.1
>            Reporter: Alejandro Abdelnur
>            Assignee: Yongjun Zhang
>            Priority: Blocker
>         Attachments: HADOOP-10895.001.patch, HADOOP-10895.002.patch, 
> HADOOP-10895.003.patch, HADOOP-10895.004.patch
>
>
> Per review feedback in HADOOP-10771, {{KerberosAuthenticator}} and the 
> delegation token version coming in with HADOOP-10771 should have a flag to 
> disable fallback to pseudo, similarly to the one that was introduced in 
> Hadoop RPC client with HADOOP-9698.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)